Malware Classification
The major malware families at a glance: behavior, propagation, and impact.
Last updated
Free, no signup · 1 page · 10 malware types · 227 KB
Which type is it? Scenario lookup
Questions and real triage both start from a described behaviour, not a name. Work backwards from what it does.
| Behaviour | Type | Why |
|---|---|---|
| Spreads by itself across the network with no user action | Worm | Self-replicating and needs no host file. The lack of user interaction is the tell. |
| Attaches to a document and spreads when that file is shared | Virus | Self-replicating but host-dependent. It cannot travel on its own. |
| Looks like a legitimate app the user chose to install | Trojan | No self-replication at all. It relies entirely on deception. |
| Files encrypted, note demanding payment | Ransomware | Impact is the goal rather than access. Often delivered by a trojan first. |
| Antivirus and admin tools cannot see the running process | Rootkit | Concealment at or below the OS level is what defines it. |
| Runs entirely in memory, nothing written to disk | Fileless | Leaves no file to scan, so detection has to be behavioural. |
| Machine takes part in a DDoS without the owner knowing | Botnet | The host is a node under external command and control. |
| Everything typed is captured and sent out | Keylogger | A specific kind of spyware, targeting input rather than files. |
| A hidden account or service lets the attacker back in later | Backdoor | Its purpose is re-entry, not damage or spread. |
| Type | Self-replicates | Needs host | Network spread | Stealth | Primary goal |
|---|---|---|---|---|---|
| Virus | Yes | Yes | No | Medium | Infect & spread via files |
| Worm | Yes | No | Yes | Low–Med | Rapid network propagation |
| Trojan | No | No | No | Medium | Deceive user for access |
| Ransomware | Sometimes | No | Sometimes | Low | Extort money via encryption |
| Spyware | No | No | No | High | Monitor & steal data |
| Keylogger | No | No | No | High | Record keystrokes |
| Rootkit | No | No | No | Very High | Hide & maintain admin access |
| Backdoor | No | No | No | High | Provide remote access |
| Botnet | Sometimes | No | Yes | Medium | Distributed control network |
| Fileless | Sometimes | No | Sometimes | Very High | Memory-only operation |
Key categories
By spread method
- VirusAttaches to host files. Spreads when files are shared.
- WormSelf-replicates across networks automatically. No user action needed.
- TrojanDisguised as legitimate software. Tricks users into installation.
By objective
- RansomwareEncrypts files, demands payment for decryption.
- SpywareSecretly monitors activity and steals information.
- RootkitHides presence while maintaining admin-level control.
Advanced types
- FilelessLives only in memory (RAM). No disk footprint.
- PolymorphicChanges its signature each infection to evade detection.
- APT malwareSophisticated, targeted attacks for long-term access.
Frequently asked questions
What is the difference between a virus and a worm?
Both self-replicate, but a virus needs a host file and a user action to spread, while a worm is self-contained and propagates across a network on its own. If a question mentions spreading without any user interaction, the answer is a worm. If it mentions infecting or attaching to files, it is a virus. This is the single most common malware question on entry-level exams.
Is a trojan a virus?
No, and the distinction matters. A trojan does not self-replicate at all. It relies on the user choosing to run it, disguised as something legitimate. Viruses and worms spread by themselves; a trojan spreads because someone was persuaded to install it. Colloquially people say "trojan virus", but on an exam they are separate categories.
Is ransomware a type of trojan?
They describe different things, which is why both can be true at once. Trojan describes how it arrives, by deception. Ransomware describes what it does, encrypt and extort. A ransomware payload is very often delivered by a trojan, so an incident can legitimately involve both labels. Classification by delivery and classification by impact are separate axes.
What makes fileless malware harder to detect?
It never writes an executable to disk, running instead in memory and through legitimate tools already on the system such as PowerShell or WMI. Signature-based antivirus has no file to scan, so detection depends on behavioural monitoring: unusual process trees, scripting engines making network connections, and suspicious use of built-in utilities.
What is the difference between a rootkit and a backdoor?
A backdoor provides a way back in. A rootkit hides things, operating at or below the operating system level to conceal processes, files and network connections, often including a backdoor. A backdoor is about access; a rootkit is about concealment. Many rootkits contain a backdoor, but a backdoor on its own makes no attempt to hide the wider system state.
About this cheat sheet
- Source
- Classification follows the categories used in NIST SP 800-83 and standard CompTIA material. Malware taxonomy has no single governing body, so boundaries between types are conventions rather than rules.
- Why types overlap
- A single sample is often several things at once: a trojan by delivery, ransomware by impact, fileless by execution. Delivery, behaviour and goal are separate axes, which is why a question can have more than one defensible answer unless it says which axis it means.
- Going deeper
- Complete malware types and classifications covers each family in detail, and the anatomy of a ransomware attack walks through one end to end.
- Corrections
- Spotted something wrong? Tell us and we will fix it. Compiled and maintained by CyberQuizzer.